UNITED STATES OF AMERICA 



Prosecution Motion 



v. ) for Preliminary Determination of 

) Admissibility of Evidence 

Manning, Bradley E, ) (Computer-Generated Records) 

PFC, U.S. Army, ) 

HHC, U.S. Army Garrison, ) 

Joint Base Myer-Henderson Hall ) 3 August 2012 

Fort Myer, Virginia 2221 1 ) 

(LI) RELIEF SOUGHT 

(U//FOUO) The prosecution in the above case respectfully requests that this Court admit into 
evidence the following account information and logs in advance of trial: Open Source Center 
(OSC) log files for the accounts bmanning and bradass87; OSC user information screenshots for 
jhe_aecounts_bma nning and brad a$s87; Intelink logs showing activity for IP addresses 

| and | and the Intelink Passport account information for the account 

bradley.e.manmng. The prosecution seeks said relief to provide improved predictability and 
efficiency to the proceedings. 

(U) This motion also serves as notice to the defense that the government intends on offering 
these documents as evidence under Military Rule of Evidence (MRE) 902(1 1 ). 

(U) B URDEN OF PERSUASION AN D BURDEN OF PROOF 

(U) The burden of proof on any factual issue, the resolution of which is necessary to decide a 
motion, shall be by preponderance of the evidence, RCM 905(c)( 1). The burden of persuasion 
on any factual issue, the resolution of which is necessary to decide a motion, shall be on the 
moving party. RCM 905(c)(2). The United States has the burden of persuasion as the moving 
party. 

(U) FACTS 

(U) U.S. Army IP address! |( hereinafter H was the Accused's primary 

SIPRNET computer at his work station in the Sensitive Compartmente d Information F acility 
(SCIF) at FOB Hammer, Iraq. See Enclosure 1. U.S. Army IP address | | (hereinafter 

|) was the Accused's secondary SIPRNET computer at his work station in the SCIF at FOB 
Hammer. See Enclosure 2. 

(U//FOUO) The Accused had an Intelink passport account. Intelink passport accounts have 
user names and passwords, and the AccusecUvas^sshjnedth^sernam See 
Enclosures 4 and 9. The email address^^^^Hfl^^H^^^^^^Hvas assigned to the 
account, and the account was last used on 27 April 2010. See Enclosure 4. 
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(U) The Intelink passport account profile contains the identifying information of the user as 
well as personalized information in the form of questions and answers. See Enclosure 9. 




(U) Intelink is the central SIPRNET search engine, analogous to www.google.com- While an 
Intelink search is the equivalent of an Internet Google search, Intelink searches websites only 
available via the SJPRNET. Searches using Intelink are typically logged. See Enclosure 3. 



(U//FOUO) Th e Intelink lo g files revealed communications between the Accused's IP 
addresses in Iraq (H3ffl2^H) and the Intelink servers. See Enclosure 3. The Intelink logs 
captured search terms that were searched on SIPRNET, as well as files that were downloaded. 
See Enclosures 3 and 8, 




(U) The significance of the searches for "julian+assange" is that Julian Assange was the co- 
founder and head spokesman ofWikileaks.org. The significance of the searches for "iceland" is 
that on 18 February 2010, Wikileaks.org posted a classified Department of State cable from the 
U,S. Embassy in Reykjavik, Iceland. Se£ Enclosure 3. The significance of the searches relating 
to cracking passwords was that in recovered chat logs on the Accused's personal computer, the 
Accused discussed using the same password cracking tools. The significance of the searches 
relating to TOR is that TOR is a distributed network of virtual tunnels that allows users to hide 
their actions while on the Internet and was used on the Accused's personal computer. £££ 
Enclosure 3 . The significance of the "collateral murder," "reuters," or "1 2 Jul 07" searches is 
that Collateral Murder was the name given to a movie created by WikiLeaks.org and released on 
5 April 2010 concerning an Apache helicopter air strike involving the death of a Reuter's 
reporter in 2007. See Enclosure 3. 



(U) The QSC user account bradas s87 was tied to the SIPRNET email address 

|and was last used on 17 April 2010. See Enclosures 4 and 
6. The Accused's AOL Instant Messenger usemame was bradass87. See Enclosure 4. The OSC 
account bmanning was tied to the SIPR email address bradley.manning@2bctl0mt[i and was East 
used on 6 November 2009. See Enclosures 4 and 5 . 



(U//FOUO) Between J 7 March 2010 and 22 March 2010, the Accused's user account on his 
,22 computer accessed the files redcell_afghanistan.pdf and recicelLcs_expoiter_terjForism.pdf. 
both located in the folder C:\Documents and Settings\bradley.manning\My Documents\blahV 
See Enclosure 4. 

(U7/FOUO) A user of the Accused's personal computer accessed a CD/DVD named 
100322_1255 which contained the fileblah.zip. The Accused's primary SIPRNET computer 
was configured to bum CD/DVDs and label them in a manner of Y YMMDD_HHMM . See 
Enclosure 4. 



(U) WITNESSES/EVIDENCE 



(U) The prosecution requests the Court consider the following: Charge Sheet and Listed 
Enclosures. 

OJ) LEGAL AUTHORITY AND ARGUMENT 

(U) The trial judge has discretion as to the manner in which she makes preliminary 
determinations concerning the admissibility of evidence. MRE 104; see U.S. v. Blanchard. 48 
M.J. 306 (C.A.A.F. 1998). This judicial discretion includes "preadmitting" evidence provided it 
is relevant and no other rule prohibits its admission. See. e.g., U.S. v. Bradford. 68 M.J. 37 1 
(C.A.A.F. 2010). Where, as here, there is no question as to the admissibility of the evidence, the 
enclosed computer-generated records should be preadmitted to provide predictability to both 
parties and to dispose of what amounts to administrative matters outside the presence of the 
panel (assuming there is a panel). 

I. (U) THE RECORDS ARE RELEVANT. 

(U) Evidence that has a tendency to make a fact of consequence more or less probable than it 
would be without the evidence is relevant. MRE 401. All relevant evidence is generally 
admissible. MRE 402. 

A. (U) OSC Logs and User Account 

(U).The OSC user account information reveals that bradass87 and bmanning were the 
Accused's user accounts, and the OSC logs show the Accused's activity on OSC. 



B. (U) Intelink Logs and Intelink Passport Account 

(U//FOUO) The Intelink Passport Account information is relevant to all the charged 
misconduct because it reveals that the bradley.e. manning account was set up and utilized by the 
Accused. See Enclosure 9. 



(U) The lntelink logs are relevant to proving the charged misconduct in all the charges. They 
establish searches by the Accused for terms relating to all the charged misconduct. See 
Enclosure 8. 

II. (U) THE RECORDS ARE NOT EXCLUDABLE AS HEARSAY BECAUSE THEY 
ARE COMPUTER-GENERATED ACTIVITY. 

(U) Hearsay is an out-of-court statement, written or oral, offered for the truth of the matter 
asserted. MRE 801(c). A statement is an oral or written assertion or the nonverbal conduct of a 
person, if it is intended by the person as an assertion. MRE 801(a). A declarant is a person who 
makes a statement. MRE 801 (b). A person must make a statement for it to be hearsay; a 
machine, therefore, cannot make a statement. See also Appellate Exhibit CCXVI ("machine 
generated data and printouts are not statements and, thus, they are not hearsay"). 

(U) United States v. Blazier. 69 M.J. 218 (C.A.A.F. 2010) is instructive on distinguishing 
between hearsay and computer generated records. In reviewing what portions of a drug testing 
report were admissible in a wrongful use case, the Court determined that testimonial hearsay 
included a signed, certified cover memorandum prepared at the request of the government for 
use at trial in which a person summarized the lab analyses. IdL at 221 fn.l. A person had written 
out what tests were conducted, what substances were detected, and the levels of each substance 
detected. Id. at 226. The cover memorandum was a written summary of the testimony that 
would be offered on the diug testing and its results. 

(U) The Blazier Court then distinguished the testimonial hearsay in the cover memorandum 
from machine-generated records, such as raw data and calibration charts, stating: "it is well- 
settled that under both the Confrontation Clause and the rules of evidence, machine-generated 
data and printouts are not statements and thus not hearsay — machines are not declarants — and 
such data is therefore not 'testimonial.'" Id at 224 (citing United States v. Lamons . 532 F.3d 
1251, 1263 (1 1th Cir. 2008); United States v. Moon. 512 F.3d 359, 362 (7th Cir. 2008); United 
States v. Washington. 498 F.3d 225, 230-3 1 (4th Cir. 2007); United States v. Hamilton . 413 F.3d 
1 138, 1 142-43 ( 10th Cir. 2005); United States v. Khorozian. 333 F.3d 498, 506 (3d Cir. 2003)). 
According to the Court, "[mjachine-generated data and printouts such as those in this case are 
distinguishable from human statements, as they 'involve so little intervention by humans in their 
generation as to lea/ve no doubt they are wholly machine-generated for all practical purposes.'" 
Blazier, 69 M.J. at 224 (quoting Lamons . 532 F.3d at 1283 n.23). 

(U//FOUO) Since the OSC logs and user account information screenshots, as well as the 
lntelink logs and Passport Account information are computer-generated, and thus not made by 
people, they cannot be hearsay. 



Ill . (U) THE RECORDS ARE AUTHENTIC. 



(U) In addition to being relevant, evidence must also be authentic to be admissible. See 
MRE 901(a). "[AJdmissibility is satisfied by evidence sufficient to support a finding that the 
matter in question is what its proponent claims." MRE 901(a). Some evidence, however, is self- 
authenticating and docs not require "[e]xtrinsic evidence of authenticity as a condition precedent 
to admissibility." MRE 902. "Certified domestic records of regularly conducted activity" fall 
under this exception. MRE 902(1 1 ). 

(U) Pursuant to MRE 902( 11), extrinsic evidence of authenticity as a condition precedent to 
admissibility is not required with respect to certified domestic records of a regularly conducted 
activity when: 

[t]hc original or a duplicate of a document or record of regularly 
conducted activity that would be admissible under Mil R. Evid. 
803(6) if accompanied by a written declaration of its custodian or 
other qualified person, in a manner complying with any Act of 
Congress or rule prescribed by the Supreme Court pursuant to 
statutory authority certifying that the record (A) was made at or 
near the time of the occurrence of the matters set forth by, or from 
information transmitted by, a person with knowledge of those 
matters; (B) was kept in the course of the regularly conducted 
activity; and (C) was made by the regularly conducted activity as a 
regular practice. 

MRE 902(1 3). 

(U) "Records of regularly conducted activity" is defined in MRE 803(6) as the following: 

[a] memorandum, report, record, or data compilation, in any form, 
of acts, events, conditions, opinions, or diagnoses, made at or near 
the time by, or from information transmitted by, a person with 
knowledge, if kept in the course of a regularly conducted business 
activity, and if it was the regular practice of that business activity 
to make the memorandum, report, record, or data compilation, all 
as shown by the testimony of the custodian or other qualified 
witness, or by certification that complies with Mil. R. Evid. 
902(11) or any other statute permitting certification in a criminal 
proceeding in a court of the United States, unless the source of the 
information or the method or circumstances or preparation lack 
trustworthiness. 



MRE 803(6). 



(U) The following attestations were made for the enclosed computer-generated filesr 



(U//FOUO) On 22 2012, ^ULaSfl M 
National Security Agency, Fort Meade, MD, attested to the authenticity of the Intelink logs for 
both the computer used by the Accused in Iraq and the Intelink Passport account information for 
the Accused. Specifically, H3KIIQ)^^Battesled to the following; the listed logs for IP address 
| with date ranges of 9 November 2009 to 30 December 2009, 23 January 20 JO to 
^^fehrjij^OlO, and 2 March 2010 to 12 May 2010; the listed logs for IP address 

| with date ranges of 9 November 2009 to 31 December 2009, 1 January 2010 to 28 
February 2010, and 1 March 2010 t o 23 May 2010; and the Intelink Passport account 
in formation for [0HII13B M contained in the file manning. Idif. See Enclosure 6, 



(U//FOUO) On 29 June 7017 [QltjltflM ■ Central 

Intelligence Agency, Washington, DC, attested to the authenticity of the OSC log files and user 
information files, specifically for those OSC accounts pertaining to the users bradass87 and 
bmanning. See Enclosure 7. 

(Uj Since the attestations accompanying all records were made in accordance with MRE 
902{1 1), all the records are property authenticated. 



IV. <U) THE RECORDS ARE IN A FORM THAT IS BEING OFFERED AS AN 

ORIGINAL OR DUPLICATE UNDER THE ORIGINAL WRITING RULE, OR 
THERE IS ADMISSIBLE SECONDARY EVIDENCE TO PROVE THE CONTENTS 
OF THE RECORDS I AW MRE 1001-1008. 



(U) "A duplicate is admissible to the same extent as an original unless (1) a genuine question 
is raised as to the authenticity of the original, or (2) in the circumstances it would be unfair to 
admit the duplicate in lieu of the original." MRE 1003. A duplicate is defined as "a counterpart 
produced by the same impression as the original, or from the same matrix, or by means of 
photography, including enlargements and miniatures, or by mechanical or electronic rerecording, 
or by chemical reproduction, or by other equivalent techniques which accurately reproduce die 
original." MRE 1001(4). "The contents of an official record . . . including data compilations in 
any form, if otherwise admissible, may be proved by copy, certified as correct or attested to in 
accordance with Mil. R. Evid. 902 or testified to be correct by a witness who has compared it 
with the original. If a copy which complies with the foregoing cannot be obtained by the 
exercise of reasonable diligence, then other evidence of the contents may be given." MRE 1005. 

(U) In the certifications for all of the enclosed records, the records custodian specifically 
states that the records are true and accurate or complete copies of the originals. There is no 
evidence that any of the original documentation may not be authentic, nor is there any 
circumstance present which would make the admission of a duplicate in lieu of the original 
unfair. The enclosures include official records, and all of them are business records. The 
duplicates, therefore, are admissible to the same extent as the originals. 



V. (U) THE PROBATIVE VALUE OF THE RECORDS IS NOT SUBSTANTIALLY 
OUTWEIGHED BY UNFAIR PREJUDICE. 



(U) Courts may exclude relevant evidence if its probative value is substantially outweighed 
by the danger of unfair prejudice, confusion, or waste of time. MRE 403. Prejudice alone is not 
sufficient to warrant exclusion. Virtually all evidence is prejudicial to one party or another. To 
justify exclusion the prejudice must be unfair. United States v. Candelaria-Silva, 162 F.3d 698, 
705 (IstCir. 1998). 

(U) In the instant case, the log records and user account information are extremely probative 
in that they track what was occurring on the computers used by the Accused and on the user 
profiles created by the Accused. The evidence is prejudicial to the Accused in that it builds the 
case against him; however, it is not unfairly prejudicial. All of the logs are relevant to the 
Accused and the charged offenses and are a direct result of the Accused's actions. The logs 
establish a timeline to make the events clear to the factfinder. 



(U) Based upon the requirements for admissibility of evidence in accordance with MRE 104, 
MRE 401, MRE 402, MRE 403, MRE 801, MRE 803(6), and MRE 902(1 1), the Government 
respectfully moves this Court, pursuant to RCM 906(13) to pre-admit the OSC logs and user 
information and the Intelink logs and user information in Enclosures 5-9 because they are 
relevant to the charges at issue and computer-generated information. They will provide 
improved predictability and efficiency to the proceedings. 



(U) I certify that I served or caused to be served a true copy of the above on Defense Security 
Experts, via electronic mail, on 3 August 2012. 



CONCLUSION 




ANGEL MVOVERGA/ 

CPT, JA 

Assistant Trial Counsel 




*NGEL M./OMERGAARD 
CPT, J A ^ 
Assistant Trial Counsel 



(U) 9 Enclosures 



1. (U) Forensic Report MANNFNG SIPR 22.225.41.22-22 Sep 1 1 (attached to AE CLXXVIII as 
Enclosure 1) 

2. (U) Forensic Report MANNING SIPR 22.225.41 .40-22 Sep 1 1 (attached to AE CLXXVIII as 
Enclosure 2) 




5. (U) OSC User Information Files (bmanning) with attestation 

6. (U) OSC User Information Files (bradass87) with attestation 

7. (U) OSC Logs (bmanning & bradass87) with attestation 



8. (U) Intelink .22 & .40 Logs with attestation 

9. (U) Intelink Passport Account Information with attestation 



UNCLASSIFIED//FOUO 



UNITED STATES OF AMERICA 
v. 

Manning, Bradley E. 

PFC, U.S. Army, 

HHC, U.S. Army Garrison, 

Joint Base Myer-Henderson Hall 

Fort Myer, Virginia 22211 



Prosecution Motion 
For Preliminary Determination of 

Admissibility of Evidence 
(Computer-Generated Records) 

Enclosures 5-6 

3 August 2012 



See Attached CD 



UNCLASSIFIED//FOUO 



UNCLASSiFiHD/;FOR OFF!C:AL USE ONLY 

ATTESTATION CERTIFICATE 

this document tss intended to meet ihe requirements set forth in Mii;ta'y Ruies of £vid»nc» R&q 902(1 i). 
addressing £s<1;f-£ii r&ftoi'ds of j^gtiiariy ecrrfjJC&d activity. 



i swear or sii'fsjrr; -hat «scr> of th« foiiowinr? is (rise regaining thy attached r^asrris, =e Uis ftest of 
krsowiedg& sr;d fc&sor: 

1. ? <sm sjis iwstodMin of thesa racers, vx f an en erriptoyee Jssra^r with frsfc marinar «r;d prpcess ir 
which fese records era trraated and maintained, by virtue of mydutifts and rasponsibiisiies; 

2.. TN record? wwfc mado at or near She ftne offce cociarence of the matters set forth by, c from 
information transmitted by, a parsers with knowSedge of those flatters; 

3.. The -iacorUs wars Kepi in the eowrs* of regofedy conduce bu»jf«»s sciiv&y; 

<l, Tfcs mcords war« mads by the regularly eenductad ac&vgy as a jegufcw prance; and 

5. Tfs* rect*d3 we a trye. aecyrass, and compete copy ol tha oHg!noi documents. 

D^'er : attached rec'wds: 

OSC log fti««, containing fofte'^lng Jog*, with ihs fdscwing d«S« f»ngej$: 



t)>t} as'iO! ng „ d s s iinc!, ..sxpori. witr; etes;yf Iceti on, x!s 
br3d^S7,.dhi(i!(i«„i»3(por^v«?ib ssassfScaslon.xfe 
ijFHdassS7_suo , i;_exfKEfi1._'*}tf) dasst?icat!0<i.xis 
- OSC user "mkw.&tica ?ilss erupted: 



20-veb-:C - 17- Apr-ID 
No date range 



t 
I 



Ojganfza&si: CanfesJ i«^«Blg«nce Agency 



(7)(C) 



: Print ix Type NsiTfi^ 




| d /& f fvtty^ 



i &4>sarib8d and svRwn to before a notary pyb'ss, thte^vX.. days? 

[ &jy commission sxpfras an: 





UNCUSSFiED/.'FOR CFRCUL USE ONLY 



ManningB_00505184 



5. OSC User Information Files 

(bmanning) 

6. OSC User Information Files 

(bradass87) 



